LSM: Generalize existing module stacking
Subsystems (13)
Casey Schaufler
maintainerPATCH 1/1 LSM: Generalize existing module stacking
Subject: [PATCH] LSM: Generalize existing module stacking
There are currently two different mechanisms used to stack security modules. The capability module is set up as the "default" module. The other modules that replace it call the functions it contains directly. The Yama module is stacked using ifdefs in the security infrastructure.
This patch changes the existing module stacking so that all stacking gets done the same way. There is no "default" module, instead there is a list of modules for each hook. The capability module is now on the list first. If Yama stacking is configured, that is added to the list next. Finally, if another module is configured it gets added to the lists. The capability calls duplicated within existing LSMs have been removed. Not all capability calls in other modules can be treated this way, and the individual cases are noted.
The next change was motivated by a discussion I had with Linus about LSM performance. We can get significant performance improvement if we put the LSM inode data into the inode rather than maintaining a pointer to data that is allocated and freed separately. Rather than having an i_security entry there is now a structure for each LSM that needs one, i_selinux and i_smack for the time being. That turned out to make the upcoming general stacking so much simpler that it is done for each of the cred, file and other structures, although those are still just pointers at this stage.
The downside is that there are more LSM configuration ifdefs in header files. There are tricks that could be used to reduce them, but they really make the code ugly. Uglier than the ifdefs, by quite a margin. If you configure LSMs that you're not using, the structures get slightly bigger. That is more than offset by the performance improvement gained by the inode change.
This is the first in a series for generalized LSM stacking.
Signed-off-by Casey Schaufler <[email protected]>
---
fs/nfs/inode.c | 14 +- include/linux/cred.h | 26 +- include/linux/fs.h | 30 +- include/linux/ipc.h | 7 +- include/linux/key.h | 7 +- include/linux/msg.h | 7 +- include/linux/security.h | 33 +- include/linux/selinux.h | 16 + include/linux/smack.h | 32 + include/net/sock.h | 7 +- ipc/msg.c | 1 - ipc/msgutil.c | 1 - ipc/sem.c | 1 - ipc/shm.c | 1 - kernel/cred.c | 57 +- net/core/sock.c | 14 +- security/Makefile | 2 +- security/apparmor/domain.c | 4 +- security/apparmor/include/context.h | 4 +- security/apparmor/lsm.c | 32 +- security/commoncap.c | 34 + security/security.c | 1590 +++++++++++++++++++++++++++++------ security/selinux/hooks.c | 406 ++++----- security/selinux/include/objsec.h | 13 - security/selinux/netlabel.c | 14 +- security/selinux/selinuxfs.c | 10 +- security/selinux/ss/services.c | 2 +- security/selinux/xfrm.c | 4 +- security/smack/smack.h | 24 +- security/smack/smack_access.c | 2 +- security/smack/smack_lsm.c | 258 +++--- security/smack/smackfs.c | 14 +- security/tomoyo/common.h | 4 +- security/tomoyo/domain.c | 2 +- security/tomoyo/gc.c | 4 +- security/tomoyo/securityfs_if.c | 6 +- security/tomoyo/tomoyo.c | 26 +- security/yama/yama_lsm.c | 36 +- 38 files changed, 1918 insertions(+), 827 deletions(-)
fs/nfs/inode.c +13 -1
@@ -276,11 +276,23 @@ void nfs_setsecurity(struct inode *inode, struct nfs_fattr *fattr, struct nfs4_label *label) {int error; +int has_label =0 ;if (label ==NULL )return ; -if ((fattr->valid &NFS_ATTR_FATTR_V4_SECURITY_LABEL ) && inode->i_security) { +#ifdef CONFIG_SECURITY_SELINUX +/* +* As of this writing the only LSM known to work with +* labeled NFS is SELinux. +* +* This should probably be +* has_label = security_inode_hasmaclabel(inode); +*/ + has_label = (inode->i_selinux.sid !=0 ); +#endif + +if ((fattr->valid &NFS_ATTR_FATTR_V4_SECURITY_LABEL ) && has_label) { error =security_inode_notifysecctx (inode, label->label, label->len);if (error)
include/linux/cred.h +23 -3
@@ -129,8 +129,17 @@ struct cred {struct key *thread_keyring;/* keyring private to this thread */ struct key *request_key_auth;/* assumed request_key authority */ #endif -#ifdef CONFIG_SECURITY -void *security;/* subjective LSM security */ +#ifdef CONFIG_SECURITY_SELINUX +void *cred_selinux;/* subjective security for SELinux */ +#endif +#ifdef CONFIG_SECURITY_SMACK +void *cred_smack;/* subjective security for Smack */ +#endif +#ifdef CONFIG_SECURITY_TOMOYO +void *cred_tomoyo;/* subjective security for TOMOYO */ +#endif +#ifdef CONFIG_SECURITY_APPARMOR +void *cred_apparmor;/* subjective security for AppArmor */ #endif struct user_struct *user;/* real user ID subscription */ struct user_namespace *user_ns;/* user_ns the caps and keyrings are relative to. */
@@ -338,7 +347,18 @@ static inline void put_cred(const struct cred *_cred)#define current_fsgid () (current_cred_xxx(fsgid))#define current_cap () (current_cred_xxx(cap_effective))#define current_user () (current_cred_xxx(user)) -#define current_security () (current_cred_xxx(security)) +#ifdef CONFIG_SECURITY_SELINUX +#define current_selinux () (current_cred_xxx(cred_selinux)) +#endif +#ifdef CONFIG_SECURITY_SMACK +#define current_smack () (current_cred_xxx(cred_smack)) +#endif +#ifdef CONFIG_SECURITY_TOMOYO +#define current_tomoyo () (current_cred_xxx(cred_tomoyo)) +#endif +#ifdef CONFIG_SECURITY_APPARMOR +#define current_apparmor () (current_cred_xxx(cred_apparmor)) +#endif extern struct user_namespace init_user_ns;#ifdef CONFIG_USER_NS
include/linux/fs.h +24 -6
@@ -29,6 +29,12 @@#include <linux/lockdep.h> #include <linux/percpu-rwsem.h> #include <linux/blk_types.h> +#ifdef CONFIG_SECURITY_SELINUX +#include <linux/selinux.h> +#endif +#ifdef CONFIG_SECURITY_SMACK +#include <linux/smack.h> +#endif #include <asm/byteorder.h> #include <uapi/linux/fs.h>
@@ -512,8 +518,11 @@ struct inode {struct super_block *i_sb;struct address_space *i_mapping; -#ifdef CONFIG_SECURITY -void *i_security; +#ifdef CONFIG_SECURITY_SELINUX +struct inode_selinux i_selinux; +#endif +#ifdef CONFIG_SECURITY_SMACK +struct inode_smack i_smack;#endif /* Stat data, not accessed from path walking */
@@ -766,8 +775,14 @@ struct file {struct file_ra_state f_ra;u64 f_version; -#ifdef CONFIG_SECURITY -void *f_security; +#ifdef CONFIG_SECURITY_SELINUX +void *f_selinux; +#endif +#ifdef CONFIG_SECURITY_SMACK +void *f_smack; +#endif +#ifdef CONFIG_SECURITY_APPARMOR +void *f_apparmor;#endif /* needed for tty driver, and maybe others */ void *private_data;
@@ -1186,8 +1201,11 @@ struct super_block {struct rw_semaphore s_umount;int s_count;atomic_t s_active; -#ifdef CONFIG_SECURITY -void *s_security; +#ifdef CONFIG_SECURITY_SELINUX +void *s_selinux; +#endif +#ifdef CONFIG_SECURITY_SMACK +void *s_smack;#endif const struct xattr_handler **s_xattr;
include/linux/ipc.h +6 -1
@@ -20,7 +20,12 @@ struct kern_ipc_permkgid_t cgid;umode_t mode;unsigned long seq; - void *security; +#ifdef CONFIG_SECURITY_SELINUX +void *kip_selinux; +#endif +#ifdef CONFIG_SECURITY_SMACK +void *kip_smack; +#endif };#endif /* _LINUX_IPC_H */
include/linux/key.h +6 -1
@@ -138,7 +138,12 @@ struct key { };struct rw_semaphore sem;/* change vs change sem */ struct key_user *user;/* owner of this key */ -void *security;/* security data for this key */ +#ifdef CONFIG_SECURITY_SELINUX +void *key_selinux;/* SELinux data for this key */ +#endif +#ifdef CONFIG_SECURITY_SMACK +void *key_smack;/* Smack data for this key */ +#endif union {time_t expiry;/* time at which key expires (or 0) */ time_t revoked_at;/* time at which key was revoked */
include/linux/msg.h +6 -1
@@ -10,7 +10,12 @@ struct msg_msg {long m_type;size_t m_ts;/* message text size */ struct msg_msgseg *next; -void *security; +#ifdef CONFIG_SECURITY_SELINUX +void *msg_selinux; +#endif +#ifdef CONFIG_SECURITY_SMACK +void *msg_smack; +#endif /* the actual message follows immediately */ };
include/linux/security.h +16 -17
@@ -101,6 +101,8 @@ extern int cap_task_setioprio(struct task_struct *p, int ioprio);extern int cap_task_setnice (struct task_struct *p,int nice);extern int cap_vm_enough_memory (struct mm_struct *mm,long pages); +extern struct security_operations capability_ops; +struct msghdr ;struct sk_buff ;struct sock ;
@@ -116,7 +118,9 @@ struct seq_file;extern int cap_netlink_send (struct sock *sk,struct sk_buff *skb); -void reset_security_ops (void ); +#ifdef CONFIG_SECURITY_SELINUX_DISABLE +void security_module_disable (struct security_operations *); +#endif #ifdef CONFIG_MMU extern unsigned long mmap_min_addr;
@@ -246,13 +250,11 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)* Security hooks for filesystem operations. * * @sb_alloc_security: -* Allocate and attach a security structure to the sb->s_security field. -* The s_security field is initialized to NULL when the structure is -* allocated. +* Allocate and attach a security structure to the sb. * @sb contains the super_block structure to be modified. * Return 0 if operation was successful. * @sb_free_security: -* Deallocate and clear the sb->s_security field. +* Deallocate and clear the sb security field(s). * @sb contains the super_block structure to be modified. * @sb_statfs: * Check permission before obtaining filesystem statistics for the @mnt
@@ -323,15 +325,12 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)* Security hooks for inode operations. * * @inode_alloc_security: -* Allocate and attach a security structure to @inode->i_security. The -* i_security field is initialized to NULL when the inode structure is -* allocated. +* Allocate and attach a security structure to @inode. * @inode contains the inode structure. * Return 0 if operation was successful. * @inode_free_security: * @inode contains the inode structure. -* Deallocate the inode security structure and set @inode->i_security to -* NULL. +* Deallocate the inode security structure(s). * @inode_init_security: * Obtain the security attribute name suffix and value to set on a newly * created inode and set up the incore security field for the new inode.
@@ -636,8 +635,8 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)* @arg contains the operational arguments. * Return 0 if permission is granted. * @file_set_fowner: -* Save owner security information (typically from current->security) in -* file->f_security for later use by the send_sigiotask hook. +* Save owner security information in +* file for later use by the send_sigiotask hook. * @file contains the file structure to update. * Return 0 on success. * @file_send_sigiotask:
@@ -679,7 +678,7 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)* cred_transfer() will not get ENOMEM. * @cred_free: * @cred points to the credentials. -* Deallocate and clear the cred->security field in a set of credentials. +* Deallocate and clear the cred field(s) in a set of credentials. * @cred_prepare: * @new points to the new credentials. * @old points to the original credentials.
@@ -867,8 +866,8 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)* socket structure, but rather, the socket security information is stored * in the associated inode. Typically, the inode alloc_security hook will * allocate and and attach security information to -* sock->inode->i_security. This hook may be used to update the -* sock->inode->i_security field with additional information that wasn't +* sock->inode. This hook may be used to update the +* sock->inode with additional information that wasn't * available when the inode was allocated. * @sock contains the newly created socket structure. * @family contains the requested protocol family.
@@ -977,7 +976,7 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)* @seclen is the maximum length for @secdata * Return 0 on success, error on failure. * @sk_alloc_security: -* Allocate and attach a security structure to the sk->sk_security field, +* Allocate and attach a security structure to the sk, * which is used to copy security attributes between local stream sockets. * @sk_free_security: * Deallocate security structure.
@@ -1147,7 +1146,7 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)* * Security hooks for individual messages held in System V IPC message queues * @msg_msg_alloc_security: -* Allocate and attach a security structure to the msg->security field. +* Allocate and attach a security structure to the msg. * The security field is initialized to NULL when the structure is first * created. * @msg contains the message structure to be modified.
include/linux/selinux.h +16 -0
@@ -19,6 +19,22 @@ struct audit_context;struct kern_ipc_perm ;#ifdef CONFIG_SECURITY_SELINUX +#include <linux/list.h> +#include <linux/mutex.h> + +struct inode ; + +struct inode_selinux { +union { +struct list_head list;/* list of inode_security_struct */ +struct rcu_head rcu;/* for freeing the inode_security_struct */ + }; +u32 task_sid;/* SID of creating task */ +u32 sid;/* SID of this object */ +u16 sclass;/* security class of this object */ +unsigned char initialized;/* initialization flag */ +struct mutex lock; +};/** * selinux_is_enabled - is SELinux enabled?
include/linux/smack.h new file +32 -0
@@ -0,0 +1,32 @@ +/* +* Copyright (C) 2014 Casey Schaufler <[email protected]> +* Copyright (C) 2014 Intel Corporation. +* +* This program is free software; you can redistribute it and/or modify +* it under the terms of the GNU General Public License as published by +* the Free Software Foundation, version 2. +* +* Author: +* Casey Schaufler <[email protected]> +* +*/ + +#ifndef _LINUX_SMACK_H +#define _LINUX_SMACK_H + +#include <linux/mutex.h> + +struct smack_known ; + +/* +* Inode Smack data +*/ +struct inode_smack { +char *smk_inode;/* label of the fso */ +struct smack_known *smk_task;/* label of the task */ +struct smack_known *smk_mmap;/* label of the mmap domain */ +struct mutex smk_lock;/* initialization lock */ +int smk_flags;/* smack inode flags */ +}; + +#endif /* _LINUX_SMACK_H */
include/net/sock.h +5 -2
@@ -411,8 +411,11 @@ struct sock {struct sk_buff *sk_send_head;__s32 sk_peek_off;int sk_write_pending; -#ifdef CONFIG_SECURITY -void *sk_security; +#ifdef CONFIG_SECURITY_SELINUX +void *sk_selinux; +#endif +#ifdef CONFIG_SECURITY_SMACK +void *sk_smack;#endif __u32 sk_mark;u32 sk_classid;
ipc/msg.c +0 -1
@@ -195,7 +195,6 @@ static int newque(struct ipc_namespace *ns, struct ipc_params *params) msq->q_perm.mode = msgflg &S_IRWXUGO ; msq->q_perm.key = key; - msq->q_perm.security =NULL ; retval =security_msg_queue_alloc (msq);if (retval) {ipc_rcu_putref (msq, ipc_rcu_free);
ipc/msgutil.c +0 -1
@@ -57,7 +57,6 @@ static struct msg_msg *alloc_msg(size_t len)return NULL ; msg->next =NULL ; - msg->security =NULL ; len -= alen; pseg = &msg->next;
ipc/sem.c +0 -1
@@ -500,7 +500,6 @@ static int newary(struct ipc_namespace *ns, struct ipc_params *params) sma->sem_perm.mode = (semflg &S_IRWXUGO ); sma->sem_perm.key = key; - sma->sem_perm.security =NULL ; retval =security_sem_alloc (sma);if (retval) {ipc_rcu_putref (sma, ipc_rcu_free);
ipc/shm.c +0 -1
@@ -504,7 +504,6 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params) shp->shm_perm.mode = (shmflg &S_IRWXUGO ); shp->mlock_user =NULL ; - shp->shm_perm.security =NULL ; error =security_shm_alloc (shp);if (error) {ipc_rcu_putref (shp, ipc_rcu_free);
kernel/cred.c +42 -15
85 lines not on this page · raw message
net/core/sock.c +12 -2
@@ -1270,7 +1270,12 @@ static inline void sock_lock_init(struct sock *sk)static void sock_copy (struct sock *nsk,const struct sock *osk) {#ifdef CONFIG_SECURITY_NETWORK -void *sptr = nsk->sk_security; +#ifdef CONFIG_SECURITY_SELINUX +void *selinux = nsk->sk_selinux; +#endif +#ifdef CONFIG_SECURITY_SMACK +void *smack = nsk->sk_smack; +#endif #endif memcpy (nsk, osk, offsetof(struct sock , sk_dontcopy_begin));
@@ -1278,7 +1283,12 @@ static void sock_copy(struct sock *nsk, const struct sock *osk) osk->sk_prot->obj_size - offsetof(struct sock, sk_dontcopy_end));#ifdef CONFIG_SECURITY_NETWORK - nsk->sk_security = sptr; +#ifdef CONFIG_SECURITY_SELINUX + nsk->sk_selinux = selinux; +#endif +#ifdef CONFIG_SECURITY_SMACK + nsk->sk_smack = smack; +#endif security_sk_clone (osk, nsk);#endif }
security/Makefile +1 -1
@@ -14,7 +14,7 @@ obj-y += commoncap.o obj-$(CONFIG_MMU) += min_addr.o # Object file lists -obj-$(CONFIG_SECURITY) += security.o capability.o +obj-$(CONFIG_SECURITY) += security.o obj-$(CONFIG_SECURITYFS) += inode.o obj-$(CONFIG_SECURITY_SELINUX) += selinux/ obj-$(CONFIG_SECURITY_SMACK) += smack/
security/apparmor/domain.c +1 -3
@@ -347,9 +347,7 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm) file_inode(bprm->file)->i_mode };const char *name =NULL , *target =NULL , *info =NULL ; -int error =cap_bprm_set_creds (bprm); -if (error) -return error; +int error =0 ;if (bprm->cred_prepared)return 0 ;
security/apparmor/include/context.h +2 -2
@@ -21,13 +21,13 @@#include "policy.h" -#define cred_cxt (X ) (X)->security +#define cred_cxt (X ) (X)->cred_apparmor#define current_cxt () cred_cxt(current_cred())/* struct aa_file_cxt - the AppArmor context the file was opened in * @perms: the permission the file was opened with * -* The file_cxt could currently be directly stored in file->f_security +* The file_cxt could currently be directly stored in file->f_apparmor * as the profile reference is now stored in the f_cred. However the * cxt struct will expand in the future so we keep the struct. */
security/apparmor/lsm.c +11 -21
@@ -96,19 +96,11 @@ static void apparmor_cred_transfer(struct cred *new, const struct cred *old)static int apparmor_ptrace_access_check (struct task_struct *child,unsigned int mode) { -int error =cap_ptrace_access_check (child, mode); -if (error) -return error; -return aa_ptrace (current, child, mode); }static int apparmor_ptrace_traceme (struct task_struct *parent) { -int error =cap_ptrace_traceme (parent); -if (error) -return error; -return aa_ptrace (parent, current,PTRACE_MODE_ATTACH ); }
@@ -140,13 +132,11 @@ static int apparmor_capable(const struct cred *cred, struct user_namespace *ns, int cap, int audit) {struct aa_profile *profile; -/* cap_capable returns 0 on success, else -EPERM */ -int error =cap_capable (cred, ns, cap, audit); -if (!error) { - profile =aa_cred_profile (cred); -if (!unconfined (profile)) - error =aa_capable (profile, cap, audit); - } +int error =0 ; + + profile =aa_cred_profile (cred); +if (!unconfined (profile)) + error =aa_capable (profile, cap, audit);return error; }
@@ -375,7 +365,7 @@ static int apparmor_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)static int apparmor_file_open (struct file *file,const struct cred *cred) { -struct aa_file_cxt *fcxt = file->f_security; +struct aa_file_cxt *fcxt = file->f_apparmor;struct aa_profile *profile;int error =0 ;
@@ -409,8 +399,8 @@ static int apparmor_file_open(struct file *file, const struct cred *cred)static int apparmor_file_alloc_security (struct file *file) {/* freed by apparmor_file_free_security */ - file->f_security =aa_alloc_file_context (GFP_KERNEL ); -if (!file->f_security) + file->f_apparmor =aa_alloc_file_context (GFP_KERNEL ); +if (!file->f_apparmor)return -ENOMEM ;return 0 ;
@@ -418,14 +408,14 @@ static int apparmor_file_alloc_security(struct file *file)static void apparmor_file_free_security (struct file *file) { -struct aa_file_cxt *cxt = file->f_security; +struct aa_file_cxt *cxt = file->f_apparmor;aa_free_file_context (cxt); }static int common_file_perm (int op,struct file *file,u32 mask) { -struct aa_file_cxt *fcxt = file->f_security; +struct aa_file_cxt *fcxt = file->f_apparmor;struct aa_profile *profile, *fprofile =aa_cred_profile (file->f_cred);int error =0 ;
@@ -471,7 +461,7 @@ static int common_mmap(int op, struct file *file, unsigned long prot, {int mask =0 ; -if (!file || !file->f_security) +if (!file || !file->f_apparmor)return 0 ;if (prot &PROT_READ )
security/commoncap.c +34 -0
@@ -994,3 +994,37 @@ int cap_mmap_file(struct file *file, unsigned long reqprot, {return 0 ; } + +#ifdef CONFIG_SECURITY + +struct security_operations capability_ops = { + .name ="capability" , + .capable = cap_capable, + .settime = cap_settime, + .ptrace_access_check = cap_ptrace_access_check, + .ptrace_traceme = cap_ptrace_traceme, + .capget = cap_capget, + .capset = cap_capset, + .bprm_set_creds = cap_bprm_set_creds, +/* +* Not stacked in the usual way. +* .bprm_secureexec = cap_bprm_secureexec, +* .inode_setxattr = cap_inode_setxattr, +* .inode_removexattr = cap_inode_removexattr, +*/ + .inode_need_killpriv = cap_inode_need_killpriv, + .inode_killpriv = cap_inode_killpriv, +/* +* Not stacked in the usual way. +* .mmap_addr = cap_mmap_addr, +*/ + .mmap_file = cap_mmap_file, + .task_fix_setuid = cap_task_fix_setuid, + .task_prctl = cap_task_prctl, + .task_setscheduler = cap_task_setscheduler, + .task_setioprio = cap_task_setioprio, + .task_setnice = cap_task_setnice, + .vm_enough_memory = cap_vm_enough_memory, +}; + +#endif /* CONFIG_SECURITY */
security/security.c +1342 -248
2,396 lines not on this page · raw message
security/selinux/hooks.c +169 -237
406 lines not on this page · raw message
security/smack/smack_lsm.c +104 -154
258 lines not on this page · raw message
The rest of this diff is not shown. View the raw message.
Part of the diff is not shown here. View the raw message.